CVE-2025-64618: Adobe Experience Manager XSS Vulnerability

CVE-2025-64618 Overview

CVE-2025-64618 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM). A low-privileged attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when the victim renders the page containing the tainted field. The flaw is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and requires user interaction to trigger. The vulnerability carries a changed scope, meaning the impact can extend beyond the initially vulnerable component to other resources within the browser session.

Critical Impact
Authenticated attackers with low privileges can persist malicious scripts in AEM form fields, enabling session hijacking, credential theft, and content manipulation against any user who views the affected page.

Affected Products

Adobe Experience Manager (AEM) — see Adobe Security Advisory APSB26-98 for exact affected versions
AEM Cloud Service deployments referenced in the advisory
On-premises AEM instances referenced in the advisory

Discovery Timeline

2026-09-08 - CVE-2025-64618 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2025-64618

Vulnerability Analysis

The vulnerability resides in how Adobe Experience Manager processes and renders user-supplied input within specific form fields. AEM fails to properly neutralize script content before storing it and later reflecting it back into rendered pages. When a victim navigates to a page containing the tainted form field, the browser parses and executes the injected script within the AEM origin.

Because the vulnerability is stored, the payload persists in AEM's backing content repository. Every subsequent visitor to the affected page becomes a target without further attacker interaction. The advisory notes a scope change, indicating the malicious script can influence resources beyond the vulnerable component, such as other AEM applications or authenticated sessions loaded in the same browser context.

Root Cause

The root cause is insufficient output encoding and input sanitization on specific form field values. AEM stores attacker-controlled markup verbatim, then emits it into the HTML response without context-aware escaping. This allows <script> tags, event handlers such as onerror or onmouseover, and other JavaScript execution vectors to survive the request-response cycle. See Adobe Security Advisory APSB26-98 for technical details.

Attack Vector

An attacker requires an authenticated AEM account with low privileges, such as a content contributor. The attacker submits crafted input into a vulnerable form field. The payload is stored server-side. When a higher-privileged user, such as an author or administrator, browses the page containing the field, the script executes in that user's authenticated session. The attacker can then exfiltrate session cookies, perform actions on behalf of the victim, or pivot to other AEM functions.

// No verified public exploit code is available for CVE-2025-64618.
// Refer to Adobe Security Advisory APSB26-98 for technical details.

Detection Methods for CVE-2025-64618

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or DOM event handlers stored in AEM form field values or JCR nodes
Outbound requests from author or publish instances to unknown domains shortly after a user views a content page
Anomalous session token usage from geographies or devices that do not match the legitimate AEM user

Detection Strategies

Review AEM access and dispatcher logs for POST requests to form submission endpoints containing encoded script payloads such as %3Cscript%3E or onerror=
Query the JCR repository for stored properties containing HTML tags or JavaScript keywords in fields that should hold plain text
Correlate content authoring events with subsequent administrative actions taken from the same browser session to identify session-riding behavior

Monitoring Recommendations

Enable content audit logging on AEM authoring instances and forward logs to a centralized analytics platform for correlation
Deploy a Web Application Firewall (WAF) in front of AEM with rules that flag script tags and JavaScript event handlers in form submissions
Alert on any modification to component templates, client libraries, or form definitions performed outside of approved change windows

How to Mitigate CVE-2025-64618

Immediate Actions Required

Apply the security update referenced in Adobe Security Advisory APSB26-98 to all affected AEM instances
Audit AEM user accounts and revoke unused low-privilege authoring accounts that could be abused to submit malicious form input
Review recent content changes on affected forms for stored script payloads and remove any suspicious entries

Patch Information

Adobe has published fixed versions in Adobe Security Advisory APSB26-98. Administrators should consult the advisory for the exact patched builds that correspond to their AEM deployment model (Cloud Service, AMS, or on-premises) and schedule updates promptly.

Workarounds

Enforce a strict Content Security Policy (CSP) on AEM-delivered pages to restrict inline script execution and untrusted script sources
Configure AEM dispatcher and WAF rules to reject requests containing HTML markup in fields that expect plain text
Restrict authoring privileges to trusted users and require multi-factor authentication for all AEM accounts to reduce the pool of low-privileged attackers

bash

# Example Content-Security-Policy response header to reduce stored XSS impact
# Configure at the AEM dispatcher or upstream reverse proxy
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"